2.35.4

19 Aug 20262 months agoaddedfixedOriginal notes

This release closes 9 security advisories

mediumInsights API Missing Per-Project Authorization Exposes Workflow Names and Execution Stats Across ProjectsGHSA-jmmj-93rg-6j39
highStrapi, SeaTable, and Mailcheck Nodes Leak Decrypted Credential Secrets into Persisted Execution Error DataGHSA-vrv8-j27g-g7cr
highGmail and Brevo nodes accept non-string content, enabling local file read and SSRFGHSA-95ph-833c-4wrp
highExpression Sandbox Escape via $fromAI Prototype Leak Leads to Host RCEGHSA-9x83-43r8-5hwc
highGit Node Remote Code Execution via Incomplete Repository-Local Configuration NeutralizationGHSA-mwp5-2m32-r54h
mediumQuery Injection in Elasticsearch and Google Cloud Firestore Nodes via Unescaped Expression InterpolationGHSA-wxwj-8wv6-vpw2
highShared-Workflow Editor Can Exfiltrate Credentials via Workflow Tool Node Inline Sub-WorkflowGHSA-4r56-g65c-fm83
highExpression Sandbox SpreadElement Bypass Enables Persistent Cross-Evaluation Native Object MutationGHSA-fg85-4wv2-p98j
highPrototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of ServiceGHSA-xwx6-jjhv-84p8

API: Return a request schema for decorator routes in /discover (#36497) (fa781db)
Google Ads Node: Select the renamed video views metric on API v25 (#36414) (a8b2716)

core: Add AI Assistant setup funnel telemetry (#36464) (7f7f0a1)
Show scopes for managed OAuth credentials with N8N_MANAGED_OAUTH_SHOW_SCOPES (#36397) (d8e3ee6)